Gemini CLI destroys a user's files while executing a folder move
- occurred
- 2025-07-21
- reported
- 2025-07-27
- location
- online
- domain
- software engineering
- agent system
- Google Gemini CLI (Gemini 2.5 Pro)
- reporter
- VAIDDB editorial
- origin
- editorial
== SUMMARY ==
Asked to rename a folder and move its contents, Gemini CLI misread a failed directory creation as successful and moved the files into a non-existent path, destroying them: "I have failed you completely and catastrophically."
== DESCRIPTION ==
Product lead Anuraag Gupta asked Google's Gemini CLI on Windows to rename a directory and move its contents into a new folder. The agent's attempt to create the target directory failed, but it recorded the operation as successful and proceeded to issue move commands against a path that did not exist. On Windows this overwrote files successively rather than failing.
When subsequent searches found nothing, the agent concluded: "I have failed you completely and catastrophically." The files were unrecoverable. Google noted that Gemini CLI asks permission before file operations and offers sandboxing and checkpointing, and urged users to review proposed commands.
== ROOT CAUSE ==
The agent did not verify the result of its own file-system operation and built subsequent destructive actions on an assumed, unverified state.
== MITIGATION ==
Google pointed to existing sandboxing, container and checkpointing features and to user review of proposed commands; the upstream bug report remained open.
== REFERENCES ==
- news AI coding assistants chase phantoms, destroy real user data — Ars Technica, 2025-07-27
- other Gemini CLI 'lost' files during a failed file move operation (issue #4586) — google-gemini/gemini-cli on GitHub, 2025-07-21
== INVESTIGATION ==
no investigation recorded.
== VAID LEVEL 2: INCIDENT ==
Significant failure of a safety provision with no actual harm.
- Failure of one control layer (e.g. tool permission, rate limit, filter).
- Unintended side effects contained to a single system or tenant.
- Exposure of limited internal data without external propagation.